01Overview
This Data Processing Agreement (DPA) forms an integral part of the service agreement between InfoLore Ltd ('Processor') and the customer organisation ('Controller'). It governs the personal data processing InfoLore carries out on the customer's behalf when delivering its awareness programme, phishing simulations, training and dark web monitoring services, under the EU General Data Protection Regulation (GDPR), the UK GDPR and Turkey's Personal Data Protection Law No. 6698 (KVKK).
02Roles and Responsibilities
The customer, as Controller, determines the purposes and means of processing. InfoLore, as Processor, processes personal data only on the customer's documented instructions and does not use it for its own purposes unless required by law. InfoLore will inform the customer immediately if it believes an instruction infringes applicable law.
03Data Processed and Data Subjects
Data subjects are the customer's employees and any other users the customer enrols in the programme. Categories of data: first name, last name and work email address; where provided by the customer, department, job title, manager and phone number; open, click, form submission and reporting events from phishing, vishing and smishing simulations; training assignments, completion records and quiz results; risk scores; and breach records showing which work email addresses appear in data leaks found during dark web scans. No special category data is processed. The purpose of processing is to measure and improve employees' cybersecurity awareness, for the duration of the service agreement.
04Confidentiality
InfoLore personnel and sub-processors with access to personal data are bound by written confidentiality obligations. Access is limited to those who need it to deliver the service.
05Security Measures
InfoLore implements appropriate technical and organisational measures to protect personal data, including encryption in transit (TLS 1.2+), least-privilege access controls, a separate tenant environment for each customer, regular security testing and incident response procedures. The service runs on Amazon Web Services infrastructure, which is ISO 27001 and SOC 2 certified. InfoLore operates in line with ISO 27001 principles.
06Sub-processors
InfoLore uses the following sub-processors: CanIPhish (Australia) for the simulation, AI-assisted training content and dark web monitoring infrastructure; Amazon Web Services for hosting the CanIPhish environment in the region chosen by the customer; Have I Been Pwned (Australia), via CanIPhish, for breach lookups on the customer's domain and work email addresses during dark web scans; Google (Google Workspace) for correspondence with the customer and for preparing and sharing reports; and Cloudflare and Resend for website infrastructure and transactional email. InfoLore has written agreements with its sub-processors containing data protection obligations equivalent to this DPA and remains liable to the customer for their performance. The customer will be notified at least 30 days before a new sub-processor is added and may object on reasonable grounds.
07Hosting Region and Data Transfers
A separate tenant is set up for each customer, and the customer chooses the AWS region where its data is stored (for example Germany, the United Kingdom, the United Arab Emirates or the United States) at the start of the service. InfoLore and CanIPhish (Australia) may access the data remotely for support and maintenance; such access is also treated as a transfer. Transfers are covered by the following safeguards: under the GDPR, European Commission adequacy decisions or Standard Contractual Clauses; under the UK GDPR, the International Data Transfer Agreement (IDTA) or the UK Addendum to the Standard Contractual Clauses; under the KVKK, for transfers from Turkey, the standard contract published by the Turkish Personal Data Protection Board. The KVKK standard contract is notified to the Turkish Personal Data Protection Authority by the transferring party within 5 business days of signature.
08Breach Notification
InfoLore will notify the customer without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting customer data. The notification will describe the nature of the breach, the categories of data and data subjects affected, its likely consequences and the measures taken, so that the customer can meet its 72-hour notification obligations under the GDPR and the KVKK.
09Assistance to the Customer
InfoLore will provide reasonable assistance to the customer in responding to data subject requests for access, rectification, erasure and objection, in data protection impact assessments, and in dealings with supervisory authorities. Requests sent directly to InfoLore will be forwarded to the customer without undue delay.
10Retention and Deletion
Upon termination of the services, InfoLore will delete or return all personal data processed on the customer's behalf within 30 days, unless retention is required by law. The customer may request deletion of data at any time during the agreement.
11Audit Rights
The customer may request information and documents to verify compliance with this DPA. On-site audits may take place with at least 30 days' written notice, no more than once a year (with additional audits following a personal data breach or at the request of a supervisory authority), during business hours and under confidentiality obligations. For sub-processors, their independent audit reports (for example AWS ISO 27001 and SOC 2 reports) are relied on first.
12Contact
For DPA-related questions, the current sub-processor list, or to request a signed DPA or KVKK standard contract, contact us at [email protected].
InfoLore Ltd · ICO ZC045356 · [email protected]